You are undoubtedly overreacting. They are talking about their own announcement, not the initial disclosure. This is 'Impact' statement from the Security Advis

You are undoubtedly overreacting. They are talking about their own announcement, not the initial disclosure. This is 'Impact' statement from the Security Advisory in question: > An attacker who can control the patch file can cause a crash or run arbitrary code under the credentials of the user who runs bspatch, in many cases, root. Their criticism is of their own work, not of the researcher.